Resolution Text
IN RE: RESEARCH INSTITUTE FOR TROPICAL MEDICINE
x---------------------------------------------x
On 22 March 2020, a line list from the Research Institute for Tropical Medicine (RITM) that contained the personal information of at least nine (9) persons under investigation (PUI) for COVID-19 circulated on Twitter and Facebook. The source tracing conducted by RITM found possible persons who may have leaked the data from two (2) of their laboratories that mainly handled the data gathering.
As a response, RITM implemented a “No Cellphone Policy” within their units and circulated a non-disclosure agreement among their employees. Consequently, the Data Protection Officer (DPO) of RITM has sent a request to the National Privacy Commission (NPC) for assistance to conduct a full investigation of this matter.
The Commission reiterates the requirement of NPC Circular No. 16-03 (Circular) for a personal information controller (PIC) like RITM to have a data breach response team, which may include its DPO. As provided in the Circular, “the team must be ready to assess and evaluate a security incident, restore integrity to the information and communications system, mitigate and remedy any resulting damage, and comply with reporting requirements.”1 Thus, the Commission finds that compliance with the Circular must first be made before NPC extends additional assistance, if warranted. The data breach response team, being the most familiar with the security incident management policy of RITM, should first conduct a proper investigation of the breach and immediately enforce the necessary remedial measures to prevent further security risks to the data subjects.
It must be stressed that notification is the general rule during a personal data breach. Considering the reported discriminations against COVID-19 patients and those who are connected or related to them, the Commission finds that this personal data breach gives rise to the risk of serious harm to those PUI whose identity may have been revealed by said breach. As such, Section 11 of the Circular requires notification upon the occurrence of this kind of personal data breach. Notably, RITM has failed to show that the breach falls under any of the exemptions allowed by law.
The Commission enjoins RITM to review its rules on personal data breach management2 as a guide to the proper procedures to be undertaken during a security incident including a personal data breach to ensure the mitigation of possible harm and negative consequences to the affected data subjects.
WHEREFORE, premises considered, the request for assistance in investigation and exemption for notification is hereby DENIED. The Research Institute for Tropical Medicine is ordered to submit, within ten (10) days of receipt of this Resolution, their full breach report including, but not limited to, the following matters:
- Facts surrounding the incident and its effects;
- Remedial actions taken by RITM;
- Outcome of the breach management, and difficulties encountered;
- Security measures in place for the protection of personal data;
- Any other policies and procedures undertaken to prevent possible harm and negative consequences to the data subject; and
- Compliance with notification requirements and assistance provided to affected data subjects.
SO ORDERED.
City of Pasay, Philippines. 22 June 2020.
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
WE CONCUR:
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
JOHN HENRY D. NAGA Deputy Privacy Commissioner
Copy furnished:
O.B.O. Representative for RITM
COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT
Footnotes
-
NPC Circular 16-03, Section 5. ↩